Is Companion for Reddit safe?

Companion for Reddit renders operator-controlled messages from its own server as raw HTML, skipping sanitization on the first render.

The extension periodically fetches message and notification content from jitt.wwevents.fun and displays it inside its popped-out Reddit window: an in-page toast shows the server-supplied text as raw HTML the first time it's rendered, before any sanitization is applied, and a separate desktop notification's title, body, icon, and click-through link are all set from the same server response. Both channels are gated by server-returned flags and only run inside the extension's own Reddit window, not arbitrary Reddit tabs.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.